# Archive
Browse past daily curated stories
Monday, October 26, 2026
-
1The Hacker News generalPHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) are being actively exploited in targeted attacks, with threat actors using agentic AI platforms for post-exploitation. In one documented case, attackers hit a European government entity and extracted password hashes and MFA data within two hours of initial exploitation — underscoring the urgency of patching PHP installations running versions 8.2–8.5.
-
2BleepingComputer generalPHP2Shell security flaws now sucessfully exploited in the wild
PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have moved beyond scanning into confirmed successful exploitation in the wild. Security practitioners should treat these critical RCE flaws as actively weaponized and prioritize emergency patching of affected PHP Windows packages across their environments.
-
3SecurityWeek generalPHP2Shell Exploitation Moves From Probes to Working Shells
PHP2Shell exploitation progressed from reconnaissance probes to fully functioning shells, with attackers launching 35 shells from two IP addresses on October 24. SecurityWeek's honeypot data confirms real-world weaponization, making this a critical patching priority for any environment running affected PHP versions 8.2–8.5 on Windows.
-
4The Hacker News generalGheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
A threat actor tracked as 'Gheist' is conducting an automated supply chain campaign using stolen GitHub tokens to inject malicious Actions workflows that exfiltrate repository secrets to attacker-controlled logs before deleting the run evidence. Wiz researchers confirmed successful compromise of private repositories and GitHub Enterprise environments, with the attack bypassing GitHub's default secret-scanning safeguards.
-
5SecurityWeek generalNode2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Google's Brotli decoder contains an out-of-bounds write vulnerability (dubbed Node2Shell/HTTP2Shell) that affects Node.js, Microsoft .NET, PowerShell, and Python packages, enabling remote code execution. Microsoft issued emergency .NET patches and PHP rebuilt Windows packages for versions 8.2–8.5 (CVE-2026-111497) within days, while Siemens, Schneider Electric, and ABB confirmed impact on industrial products.
-
6The Hacker News generalMicrosoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Huntress researchers documented a Microsoft 365 adversary-in-the-middle (AitM) campaign active between July 14 and September 22, 2026, that captured sign-in session tokens and replayed them to compromise 97 accounts across 79 organizations, generating 497 successful unauthorized sign-in events. The attack bypasses MFA by stealing post-authentication tokens rather than credentials, targeting email accounts at scale.
-
7SecurityWeek generalIndustrial Vendors Check Products for PHP2Shell Vulnerabilities
Siemens, Schneider Electric, and ABB have confirmed that some of their operational technology and industrial control products are affected by the PHP2Shell/Brotli-family vulnerabilities, broadening the attack surface beyond standard IT environments. ICS-focused security teams should consult vendor advisories to assess exposure in OT networks where patching timelines are typically longer.
-
8The Hacker News generalHackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unidentified threat actor has compromised 953 Magento-based online stores since July 2025 using scanner-evading JavaScript injected via CMS blocks, according to Dutch e-commerce security firm Sansec. The stealthy loader serves malicious JavaScript payloads only to visiting end users, making server-side detection difficult and enabling sustained skimming operations at scale.
-
9The Record threat-intelPopular AI tool LiteLLM says unrevoked key allowed hackers to target users
LiteLLM, an open-source AI gateway tool used widely by AI developers, disclosed that a signing key accidentally exposed in May was exploited in a supply chain attack that reached tens of thousands of users in the week of October 19. The unrevoked key allowed attackers to inject malicious packages into the LiteLLM distribution pipeline, highlighting the risk of long-lived exposed secrets in open-source AI tooling.
-
10The Hacker News generaluCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
A commercially available Android spyware kit called uCreator can steal Telegram two-factor authentication passwords and clone WeChat accounts by hiding inside trojanized versions of both apps distributed outside official app stores. Researcher Ovi linked uCreator's Telegram component to the Baohuo backdoor previously documented by Doctor Web, confirming it as an established threat actor's tooling now available for rent.